Compensation for distress caused by breach of the DPA 1998
The High Court has awarded compensation to two claimants for stress arising from a beach of Principle 4 of the Data Protection Act 1998 (DPA 1998) involving the processing of inaccurate personal data concerning them.
The defendant had been commissioned to investigate any links between Russia, its President and Donald Trump, and produced a dossier setting out its findings (the Dossier). Personal data was included in the Dossier relating to the claimants which they said:
were inaccurate and thus contrary to the fourth data protection principle of the DPA 1998; and
had been processed by the defendant unfairly, unlawfully and otherwise in breach of the first data protection principle of the DPA 1998.
The claimants applied for an order for compensation, rectification of the data and other remedies under the DPA 1998.
The High Court held that a theory in part of the Dossier was inaccurate and its disclosure by the defendant involved a breach of the fourth data protection principle.
It was found that the defendant had failed to take reasonable steps to verify the allegation.
Two claimants were awarded £18,000 each as compensation for the distress they suffered by reason of the breach, in accordance with section 13 of the DPA 1998.
A limited order for rectification was granted and any wider order under section 14(1) to (3) of the DPA 1998 was refused.
The trial judge found, amongst other things, that:
The damages that may be awarded were not confined to material loss, and compensation for distress is recoverable in any case, even if there was no material loss.
In principle, the claimants' damages could include compensation for harm to their reputation.
The “publication” of the Dossier was limited.
There was "...no evidence that the opinion of any of the recipients was of particular concern to these claimants, or that the recipients took any particular steps that led to identifiable harm".
The claimants were of "robust character, not given to undue self-pity" and therefore only modest damages for distress suffered due to the breach should be awarded.
The award of damages is notable because of the potential for claims for compensation for breach of the GDPR under Article 82(1).
This judgement also sets a potential point of reference for assessing the quantum of damages for a breach of the GDPR.